Invalid memory access in Sentencepiece versions less than 0.2.1 when using a vulnerable model file, which is not created in the normal training procedure.

The remote Fedora 44 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-314504fd18 advisory.

    Update to 0.2.1

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 45 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-8755a17c6e advisory.

    Automatic update for sentencepiece-0.2.1-1.fc45.

    ##### **Changelog**

    ```
    * Tue May 19 2026 Peter Robinson <pbrobinson@gmail.com> - 0.2.1-1
    - Update to 0.2.1
    - Fixes CVE-2026-1260 (rhbz#2432139 rhbz#2432139)
    - Minor package updates for new rev

    ```

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Invalid memory access in Sentencepiece versions less than 0.2.1 when using a vulnerable model file, which
    is not created in the normal training procedure. (CVE-2026-1260)

ID	Name	Product	Family	Severity
319928	Fedora 44 : sentencepiece (2026-314504fd18)	Nessus	Fedora Local Security Checks	high
318116	Fedora 45 : sentencepiece (2026-8755a17c6e)	Nessus	Fedora Local Security Checks	high
436906	SCA: security update for sentencepiece (GHSA-38vq-g6vr-w8wf)	Tenable Cloud Security	SCA Checks	high
436906	SCA: security update for sentencepiece (GHSA-38vq-g6vr-w8wf)	Tenable Self-Hosted Container Security	SCA Checks	high

Detections

Analytics

CVE-2026-1260

high

Tenable Plugins

high

high

high

high